Centralized the credentials-check.
Store failed login-attempts in the database.
Slow down the "bot" if there are more then 3 login-attempts.
Reset the login-attempts

When a user successfully authenticates we can clear his/her failed
attempts, we have the logs to use as a fallback.